CVE

CVE-2026-103916

View on NVD ↗

Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory

Exploitation IoCs 5

Domain files[.]dreamhost[.]com
Filename sbx cp
GitHub Repo SolanaCry
IP 199[.]19[.]77[.]84
Package Google Play Services

MITRE ATT&CK TTPs 8

T1055
Process Injection
Defense Evasion
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1078.002
Domain Accounts
Defense Evasion
 T1090
Proxy
Command And Control
 T1212
Exploitation for Credential Access
Credential Access
 T1482
Domain Trust Discovery
Discovery
 T1566
Phishing
Initial Access

Source Articles

ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories
Multiple critical security incidents were reported, including a pre-authentication remote code execution vulnerability in Apache OFBiz (CVE-2026-68524) and an authentication bypass flaw (CVE-2026-109928), both now patched. DreamHost suffered a data breach where an attacker exploited a vulnerability to access FTP/SFTP credentials and webmail session data. DeFi websites registered with Name.com were hijacked via DNS changes, leading to $138K in crypto thefts through a Step Drainer malware kit. Additionally, stolen Entra ID credentials were abused to access Microsoft 365 and Azure environments across 27 organizations, with malicious sign-ins traced to IP 199.19.77.84. Android banking trojan Mirax, attributed to threat actor Aquafina, targeted META region users, enabling real-time device control and financial fraud.
hacker-news Nov 5, 2026